CSRF (cross-site request forgery)

In short: In CSRF an attacker makes a signed-in user’s browser perform an unwanted action on another site, for example a transfer.

In more detail: The browser automatically sends cookies with every request to the target address. A prepared page can thus send a hidden form to the bank’s website, and the bank considers the request genuine.

In Depth

• SameSite cookies: SameSite=Lax or Strict prevent cookies from being sent with third-party requests.
• CSRF token: a secret value in the form that only the real page knows.
• Check origin: The server compares Origin or Referer with its own address.
• POST only for changes: Never change state via GET.
• Frameworks: Next.js server actions additionally check the origin.

See also: Cookies, OWASP Top 10